In response to a data breach on March 18, 2022, the Information Regulator has issued an enforcement notice against credit bureau TransUnion. The breach, allegedly orchestrated by the group N4ugthySecTU, resulted in the exfiltration of data from one of TransUnion’s databases, including records of 54 million South Africans.

While TransUnion initially estimated that 3 million customers were affected, it later revised the number to 5 million consumers potentially impacted by the incident. Additionally, 5.2 million consumers had only their ID numbers exposed, without linked personal information.

Despite a US$15 million ransom threat, TransUnion refused to pay to prevent data leakage. However, shortly after the breach, the Information Regulator criticized TransUnion for its notification not meeting Protection of Personal Information Act requirements.

Following an assessment, the Information Regulator found that TransUnion breached conditions for legally processing personal information. Among the highlighted issues were failures to secure confidentiality, implement appropriate technical measures, and prevent unlawful access to personal information.

As a result, the Information Regulator has mandated three remedial steps for TransUnion. Firstly, TransUnion must implement security measures to safeguard the integrity and confidentiality of personal information. Secondly, it must enlist a qualified auditor to assess all user accounts against its SFTP user creation policy. Lastly, TransUnion must conduct a personal information impact assessment to ensure compliance with lawful processing conditions.

TransUnion has until May 26, 2024, to provide proof of implementing these measures. Failure to comply may lead to further regulatory action.